Issued:

2007-10-08

Updated:

2007-10-08

RHSA-2007:0909 - Moderate: kdelibs security update

Synopsis

Moderate: kdelibs security update

Type/Severity

Security Advisory Moderate

Topic

Updated kdelibs packages that resolve several security flaws are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Description

The kdelibs package provides libraries for the K Desktop Environment (KDE).

Two cross-site-scripting flaws were found in the way Konqueror processes certain HTML content. This could result in a malicious attacker presenting misleading content to an unsuspecting user. (CVE-2007-0242, CVE-2007-0537)

A flaw was found in KDE JavaScript implementation. A web page containing malicious JavaScript code could cause Konqueror to crash. (CVE-2007-1308)

A flaw was found in the way Konqueror handled certain FTP PASV commands. A malicious FTP server could use this flaw to perform a rudimentary port-scan of machines behind a user's firewall. (CVE-2007-1564)

Two Konqueror address spoofing flaws have been discovered. It was possible for a malicious website to cause the Konqueror address bar to display information which could trick a user into believing they are at a different website than they actually are. (CVE-2007-3820, CVE-2007-4224)

Users of KDE should upgrade to these updated packages, which contain backported patches to correct these issues.

Solution

Before applying this update, make sure that all previously-released errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at This content is not included.http://kbase.redhat.com/faq/FAQ_58_10188

Affected Products

Updated Packages

• kdelibs-devel-3.3.1-9.el4.ppc.rpm
• kdelibs-devel-3.5.4-13.el5.s390.rpm
• kdelibs-apidocs-3.5.4-13.el5.ia64.rpm
• kdelibs-apidocs-3.5.4-13.el5.x86_64.rpm
• kdelibs-3.5.4-13.el5.ia64.rpm
• kdelibs-devel-3.3.1-9.el4.x86_64.rpm
• kdelibs-3.5.4-13.el5.s390.rpm
• kdelibs-devel-3.5.4-13.el5.i386.rpm
• kdelibs-3.3.1-9.el4.s390.rpm
• kdelibs-3.3.1-9.el4.ppc.rpm
• kdelibs-3.3.1-9.el4.i386.rpm
• kdelibs-3.3.1-9.el4.src.rpm
• kdelibs-devel-3.3.1-9.el4.s390x.rpm
• kdelibs-3.5.4-13.el5.ppc.rpm
• kdelibs-apidocs-3.5.4-13.el5.i386.rpm
• kdelibs-3.3.1-9.el4.x86_64.rpm
• kdelibs-3.5.4-13.el5.x86_64.rpm
• kdelibs-devel-3.5.4-13.el5.ppc.rpm
• kdelibs-devel-3.5.4-13.el5.ppc64.rpm
• kdelibs-devel-3.3.1-9.el4.ia64.rpm
• kdelibs-3.5.4-13.el5.s390x.rpm
• kdelibs-apidocs-3.5.4-13.el5.ppc.rpm
• kdelibs-devel-3.5.4-13.el5.s390x.rpm
• kdelibs-devel-3.5.4-13.el5.x86_64.rpm
• kdelibs-apidocs-3.5.4-13.el5.s390x.rpm
• kdelibs-3.5.4-13.el5.i386.rpm
• kdelibs-3.3.1-9.el4.ppc64.rpm
• kdelibs-3.3.1-9.el4.ia64.rpm
• kdelibs-devel-3.5.4-13.el5.ia64.rpm
• kdelibs-3.5.4-13.el5.ppc64.rpm
• kdelibs-3.3.1-9.el4.s390x.rpm
• kdelibs-devel-3.3.1-9.el4.s390.rpm
• kdelibs-3.5.4-13.el5.src.rpm
• kdelibs-devel-3.3.1-9.el4.i386.rpm

Fixes

• This content is not included.BZ - 229606
• This content is not included.BZ - 233592
• This content is not included.BZ - 234633
• This content is not included.BZ - 248537
• This content is not included.BZ - 251708
• This content is not included.BZ - 299891

CVEs

• CVE-2007-0242
• CVE-2007-4224
• CVE-2007-3820
• CVE-2007-1564
• CVE-2007-1308
• CVE-2007-0537

References

• http://www.redhat.com/security/updates/classification/#moderate

Additional information

• The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
• Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.